vue
The progressive JavaScript framework for building modern web UI.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/vue.common.js | AI (source-diff): Vue.js dist bundle legitimately uses new Function() for template compilation and may reference network APIs. Standard framework build output. | ai | |
| phantom-deps | phantom-dep:envify | AI (phantom-deps): envify is used as a browserify transform declared in package.json's browserify config, not a direct import. Legitimate pattern. | ai | |
| source-diff | obfuscated-file:coverage/PhantomJS 1.9.7 (Mac OS X)/lcov-report/prettify.js | AI (source-diff): Google code-prettify bundled in karma-coverage lcov HTML report output; minified by design, not obfuscated malware. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Vue's internal ViewModel.require for component module resolution; standard framework pattern. | ai | |
| source-diff | net-exec-file:dist/vue.js | AI (source-diff): dist/vue.js is Vue's standard bundled distribution file; network+exec pattern is the Component.js module loader, not malware. | ai | |
| provenance | missing-githead | AI (provenance): Vue 3 monorepo publish workflow differs from Vue 2; missing gitHead is expected for this package's build pipeline. | ai | |
| source-diff | obfuscated-file:coverage/PhantomJS 1.9.2 (Mac OS X)/lcov-report/prettify.js | AI (source-diff): Google code-prettify library shipped minified inside a Karma/Istanbul coverage report artifact. Not malicious obfuscation. | ai | |
| source-diff | net-exec-file:dist/vue.global.js | AI (source-diff): Vue's global IIFE build; template compiler requires dynamic code execution. Standard framework distribution file. | ai | |
| source-diff | obfuscated-file:dist/vue.runtime.global.prod.js | AI (source-diff): Minified runtime-only global production build; standard Vue distribution artifact. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Vue ships multiple dist bundles (ESM, global, runtime, full); 33 files is normal for Vue 3.x distribution. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Diff baseline is v0.8.1 (ancient); Vue 3.x is naturally much larger. Size is consistent with the framework. | ai | |
| source-diff | net-exec-file:dist/vue.esm-browser.js | AI (source-diff): Vue's template compiler and runtime legitimately use dynamic code execution (new Function) and network-related patterns. Standard framework code. | ai | |
| source-diff | net-exec-file:dist/vue.esm-browser.prod.js | AI (source-diff): Minified production build of Vue's ESM browser bundle; same legitimate code as the non-minified version. | ai | |
| source-diff | obfuscated-file:dist/vue.runtime.esm-browser.prod.js | AI (source-diff): Minified runtime-only ESM production build; standard Vue distribution artifact. | ai | |
| source-diff | net-exec-file:dist/vue.global.prod.js | AI (source-diff): Minified production build of Vue's global bundle; legitimate framework code. | ai | |
| source-diff | obfuscated-file:dist/vue.esm-browser.prod.js | AI (source-diff): Standard minified production build of Vue.js; .prod.js files are always minified. Not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/vue.global.prod.js | AI (source-diff): Standard minified production build; long lines are from minification, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/vue.runtime-with-vapor.esm-browser.prod.js | AI (source-diff): Minified production bundle; standard for Vue.js distribution artifacts. | ai | |
| source-diff | obfuscated-file:dist/vue.runtime-with-vapor.esm-browser.js | AI (source-diff): Minified distribution bundle with copyright header and standard Vue.js utility code; expected for production builds. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from yyx990803 to GitHub Actions is documented CI/CD automation; legitimate maintainer workflow for Vue. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() is used in Vue's template compiler for expression validation — a well-documented, intentional design pattern, not a security risk for this package. | ai | |
| provenance | no-provenance | AI (provenance): Vue predates Sigstore provenance workflows; absence of attestation is not a risk signal for this well-established package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Vue is an actively maintained major framework; team maintainer additions are expected and consistent with the official vuejs org's practices. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Added deps (@vue/compiler-sfc, @vue/server-renderer) are official first-party Vue sub-packages by the same maintainer, not third-party additions. | ai | |
| dependencies | unvetted-dep:@vue/compiler-sfc | AI (dependencies): @vue/compiler-sfc is a first-party Vue.js monorepo package; it will always be a dependency of vue and is not a real risk. | ai | |
| typosquat | typosquat.levenshtein:vite | AI (typosquat): 'vue' is the canonical Vue.js package with 11M+ weekly downloads; not a typosquat of vite. | ai | |
| typosquat | typosquat.levenshtein:yup | AI (typosquat): 'vue' is the canonical Vue.js package; not a typosquat of yup. | ai |
Versions (showing 29 of 229)
| Version | Deps | Published |
|---|---|---|
| 0.11.5 | 0 / 19 | |
| 0.11.4 | 0 / 19 | |
| 0.11.2 | 0 / 19 | |
| 0.11.1 | 0 / 19 | |
| 0.11.0 | 0 / 19 | |
| 0.10.6 | 0 / 22 | |
| 0.10.5 | 0 / 22 | |
| 0.10.4 | 0 / 26 | |
| 0.10.3 | 0 / 26 | |
| 0.10.2 | 0 / 26 | |
| 0.10.1 | 0 / 26 | |
| 0.10.0 | 0 / 26 | |
| 0.9.3 | 0 / 26 | |
| 0.9.2 | 0 / 26 | |
| 0.9.1 | 0 / 26 | |
| 0.9.0 | 0 / 26 | |
| 0.8.8 | 0 / 26 | |
| 0.8.7 | 0 / 26 | |
| 0.8.4 | 0 / 26 | |
| 0.8.2 | 0 / 26 | |
| 0.8.1 | 0 / 26 | |
| 0.8.0 | 0 / 26 | |
| 0.7.6 | 0 / 26 | |
| 0.7.5 | 0 / 24 | |
| 0.7.4 | 0 / 12 | |
| 0.7.3 | 0 / 12 | |
| 0.7.1 | 0 / 10 | |
| 0.7.0 | 0 / 10 | |
| 0.6.0 | 0 / 9 |
v0.11.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.2
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.1
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.2
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.8
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.7
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.2
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.5
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.